[seam→cloud] Measure the cloud leg of the remaining plugin-manifest keys (runtime, integrity, capabilities/configuration/extensions, structured permissions) — unblocks #11330 #11331 #11332 #11333

Cross-seat measurement request, filed by the domain:spec executor seat (R7, session_01E5LFCYBJ3q2s6yW6oMLxwy). Seam card in this repo because the cloud repo is not readable from this seat (add_repo denied, re-measured 2026-08-26 — same result as the three measurements on record).

Named reader: the repo:cloud executor seat (seat post #6026) — a one-reading task, same shape as #10812 which your lane already served.

Why a second card exists

#10812 measured the cloud leg for manifest.contributes only (verdict: clean, cloud @ 5b5925a). A scope-extension ask on that card (comment of 2026-08-23T14:37Z) requested the WHOLE manifest surface for four other parked cards, but the measurement that closed #10812 did not cover it — so #11330–#11333's blocker closed without their evidence ever being taken. This card re-establishes a live unlock edge; those four cards' Blocked-by: lines now point here.

Ready-to-run commands (cloud repo root, current main; paste raw output back on THIS card)

git rev-parse --short HEAD
# PRIMARY: property reads of the four manifest key families
grep -rnE '\.(runtime|integrity|capabilities|configuration|extensions|permissions)\b' \
  --include='*.ts' --include='*.tsx' --include='*.mts' --include='*.mjs' --include='*.js' \
  . | grep -v node_modules | grep -v /dist/ | grep -v '\.test\.' | grep -v '\.spec\.' \
  | grep -iE 'manifest' 
# PRIMARY (wider net, manifest-variable reads the name filter above can miss):
grep -rnE 'manifest[A-Za-z]*\.(runtime|integrity|capabilities|configuration|extensions|permissions)' \
  --include='*.ts' . | grep -v node_modules | grep -v /dist/ | grep -v '\.test\.'
# CONTROL B: manifest reads are findable at all in this repo
grep -rnE 'manifest\.(namespace|plugins|id)' --include='*.ts' . | grep -v node_modules | grep -v /dist/ | grep -cv '\.test\.'
# CONTROL C: the key words exist in the corpus (a zero is about the path, not the word)
for w in runtime integrity capabilities configuration extensions permissions; do
  printf '%s: ' "$w"; grep -rn --include='*.ts' -w "$w" . | grep -v node_modules | grep -v /dist/ | grep -cv '\.test\.'
done

Interpretation: PRIMARY empty with CONTROL B > 0 ⇒ the cloud leg is clean for that key; post per-key readings — each of the four cards has its own recorded unlock disposition (#11330 runtime and #11333 permissions go to the DECISION BOX with the evidence — security/ADR-0025 trust-tier calls, manual floor; #11331/#11332 follow their triage notes). Any PRIMARY hit ⇒ post the hit lines; the affected card's fork re-scopes around that reader.

Direction of the dependency edge, for the unlock scan: #11330 #11331 #11332 #11333 wait on THIS card — their Blocked-by: lines point here. This card itself waits on nothing; closing it (with the readings posted) releases all four.

Claim: cross-lane direct takeover under the simple-blocker clause (maintainer 2026-08-13) — this card blocks four domain:spec cards (#11330–#11333), and it is a mechanical, fully-specified, read-only S-level measurement; the blocked seat takes it rather than waiting.
Session: session_01KX8wnyjStaZcuMyAMNsy3N (domain:spec seat, R1)
Branch: none — read-only measurement, zero file edits, no worktree
Domain: repo:cloud queue card, executed by the domain:spec seat; cloud seat's hot-file serial queue untouched (nothing is written)
File surface: none — git grep against cloud origin/main (15f55df) only
Container & model: S mechanical, in-session (no dev dispatch)
Clause-②: no
Serial constraints cleared: none apply — zero writes anywhere.

Basis for the takeover: this session's authorized surface INCLUDES objectstack-ai/cloud (the seam card exists only because prior spec/triage sessions measured add_repo denied — that transport limitation does not hold here). Readings follow in the next comment.

Generated by Claude Code

Readings — cloud `origin/main` @ `15f55df` (fetched 2026-08-29T15:08Z)

Protocol: the card's commands, adapted to git grep against origin/main (no checkout, no writes); test/spec files excluded; dist/ excluded. Interpretation discipline per the refined #12456 protocol: a PRIMARY hit counts only if the receiver is a plugin manifest object.

PRIMARY (narrow: property reads, manifest-filtered) — 24 hits, classified line by line

Discharged as non-plugin-manifest receivers (the #10812 req.query?.contributes template):

packages/service-cloud/src/r2-registry-reader.ts:139,148,231 + registry-mirror.ts:107-108 — receiver is EnvironmentManifest (environmentId / head.commit / encrypted runtime config), the environment registry shape, not the .osplugin manifest.
scripts/ee-release-manifest.mjs:275-596 — release manifest; its runtime is an object (version / compatibility), a different shape entirely.
apps/cloud/scripts/check-demo-manifest.ts:32 — demo manifest.

REAL plugin-manifest reads (receiver verified by reading each context):

packages/service-cloud/src/plugin-artifact.ts:179:        runtime: manifest.runtime,
packages/service-cloud/src/plugin-artifact.ts:181:        permissions: manifest.permissions ? JSON.stringify(manifest.permissions) : undefined,
packages/service-cloud/src/plugin-artifact.ts:182:        integrity: manifest.integrity ? JSON.stringify(manifest.integrity) : undefined,
packages/service-cloud/src/routes/environment-crud.ts:1607:  const declaredPerms2 = parsePermissions(manifest2?.permissions);
packages/service-cloud/src/routes/package-install.ts:902:   const declared = parsePermissions(manifest?.permissions);
packages/service-cloud/src/routes/package-publish.ts:531:   runtime: prepared.manifest!.runtime,
packages/service-cloud/src/routes/package-publish.ts:532:   permissions: prepared.manifest!.permissions ?? null,

CONTROLS

CONTROL B (manifest reads findable at all): manifest.(namespace|plugins|id) → 15 non-test hits. The probe sees this repo.
CONTROL C (key words in corpus, non-test): runtime 1126 · integrity 16 · capabilities 36 · configuration 55 · extensions 0 · permissions 186 · sandbox 15 · digests 0 · granted_permissions 9.
Bracket-access probe (["key"] spellings, manifest-filtered): 0 hits.

Per-key verdicts

key	cloud verdict	evidence
`runtime`	LIVE — behavioral dispatch	`plugin-permission-audit.ts:60-90` (`auditPluginPermissions`, called from `package-publish.ts:530`): `runtime === 'node'` + unverified publisher ⇒ hard block (caller turns it into a 422, message: "The 'node' runtime tier (in-process, full-trust) requires a verified publisher signature. Sign the artifact with a registered publisher key, or use the 'sandbox' tier."); `runtime:node` is also a sensitivity flag forcing human review (no inline auto-approve). This is ADR-0025 §3.6 default-deny, implemented at the publish door. Also persisted to the version row (`plugin-artifact.ts:179`, `package-publish.ts:531`).
structured `permissions`	LIVE — behavioral, structured arm confirmed	`plugin-consent.ts` (ADR-0025 Phase 3, PD5): `parsePermissions` consumes exactly the structured `{services, hooks, network, fs}` shape (its own doc: "mirrors `@objectstack/spec/kernel`'s `PluginPermissions`"); `permissionsWiden` turns a widening upgrade without re-consent into a 409 (`package-install.ts:641,902`; `environment-crud.ts:1602-1641`); consented set persisted to `sys_package_installation.granted_permissions` (audit trail, 9 non-test hits), which the doc says the environment runtime later feeds to the framework's `PluginPermissionEnforcer` (F4). `auditPluginPermissions` additionally flags `fs` and broad `network` as sensitive at publish. `plugin-permission-audit.ts` imports `PluginPermissions` from `@objectstack/spec/kernel` — a direct spec-schema type consumer.
`integrity`	persist-only — no verifier	Persisted at publish (`plugin-artifact.ts:182` → `PluginVersionFields.integrity`), but `digests` has 0 occurrences in the corpus and no unpack-side verification exists. Cloud stores the map; nothing checks it.
`capabilities`	CLEAN	0 plugin-manifest reads (36 word hits are unrelated receivers; narrow/wide/bracket probes all 0 on manifest receivers).
`configuration`	CLEAN	0 plugin-manifest reads (55 word hits unrelated).
`extensions`	CLEAN — word absent entirely	0 occurrences corpus-wide (CONTROL C), so a fortiori 0 manifest reads.

Dispositions (executed on each card per its recorded unlock plan)

Three plugin-manifest blocks — capabilities, configuration, extensions — have zero reads of the container itself, so all 8 keys beneath them are inert (configuration.properties.secret promises encryption/masking) #11332 (capabilities/configuration/extensions) — all three CLEAN ⇒ the queue-shaped member per its triage note; returning to pm:queue.
[text correction · ruled B] manifest.runtime tombstone/describe reads truthfully: publish-gate enforced (cloud), load-side NOT enforced #11330 (runtime) — premise re-scoped: the tier IS enforced at cloud's publish door (default-deny for unverified node), still unenforced at framework load time ⇒ decision box with this evidence, per the recorded disposition.
manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 (integrity) — cloud persists, nothing verifies ⇒ decision box (security-posture fork), per its triage note.
manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333 (structured permissions) — PRIMARY hit ⇒ fork re-scopes around the live cloud consumer; decision box per the recorded disposition.

Closing this card as completed — the readings above are the deliverable. Takeover receipt: measured and filed by the domain:spec seat under the simple-blocker clause; nothing in the cloud repo was written.

Generated by Claude Code

feat(spec): fifth liveness verdict live-elsewhere — dead here, enforc…

feat(spec): live-elsewhere — fifth liveness verdict with gate-executa…

fix(pm): H19 judges a `Blocked-by:` block against the body's target s…

fix(spec): os migrate meta guidance for the ui-* and plugin-* migrati…

Navigation Menu

Repository navigation

[seam→cloud] Measure the cloud leg of the remaining plugin-manifest keys (`runtime`, `integrity`, `capabilities`/`configuration`/`extensions`, structured `permissions`) — unblocks #11330 #11331 #11332 #11333 #12400

Why a second card exists

Ready-to-run commands (cloud repo root, current main; paste raw output back on THIS card)

Readings — cloud `origin/main` @ `15f55df` (fetched 2026-08-29T15:08Z)

PRIMARY (narrow: property reads, manifest-filtered) — 24 hits, classified line by line

CONTROLS

Per-key verdicts

Dispositions (executed on each card per its recorded unlock plan)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[seam→cloud] Measure the cloud leg of the remaining plugin-manifest keys (runtime, integrity, capabilities/configuration/extensions, structured permissions) — unblocks #11330 #11331 #11332 #11333 #12400

Description

Why a second card exists

Ready-to-run commands (cloud repo root, current main; paste raw output back on THIS card)

Activity

os-project-manager commented on Aug 29, 2026

os-project-manager commented on Aug 29, 2026

Readings — cloud origin/main @ 15f55df (fetched 2026-08-29T15:08Z)

PRIMARY (narrow: property reads, manifest-filtered) — 24 hits, classified line by line

CONTROLS

Per-key verdicts

Dispositions (executed on each card per its recorded unlock plan)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[seam→cloud] Measure the cloud leg of the remaining plugin-manifest keys (`runtime`, `integrity`, `capabilities`/`configuration`/`extensions`, structured `permissions`) — unblocks #11330 #11331 #11332 #11333 #12400

Readings — cloud `origin/main` @ `15f55df` (fetched 2026-08-29T15:08Z)